Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    28/06/2024, 03:15

General

  • Target

    d93d559125f5d30867c92b8ec096b89fd1df610c451a02684d538725cc0881c3.exe

  • Size

    81KB

  • MD5

    f7b95acfcda244e70346332ef079eeed

  • SHA1

    40b7e4506606d62306496cbe0b1003a9db5c5467

  • SHA256

    d93d559125f5d30867c92b8ec096b89fd1df610c451a02684d538725cc0881c3

  • SHA512

    d45d9eac92c9e9991ffe8290b1e6c459f177b6002e4e810bf7b25f67e064ae6874bf99cd5a4d175756cd3b8d8289a6c7eafa7204c24d2c328b005127d73c2b9b

  • SSDEEP

    1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8jsfEiDtL:enaypQSoTEix

Score
9/10

Malware Config

Signatures

  • Renames multiple (715) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d93d559125f5d30867c92b8ec096b89fd1df610c451a02684d538725cc0881c3.exe
    "C:\Users\Admin\AppData\Local\Temp\d93d559125f5d30867c92b8ec096b89fd1df610c451a02684d538725cc0881c3.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-39690363-730359138-1046745555-1000\desktop.ini.tmp

    Filesize

    81KB

    MD5

    579eb0cda191efb92651b13ad28626ae

    SHA1

    3dd415a0811ef45eeb5fcda6c93298943621858b

    SHA256

    3b156f0ff1fe8b412c2f17aa6ccffcaf2fa37ca6555191b6be1582ea92a65829

    SHA512

    3bf30149114c3518c05fa8dfb3d4c48eff617ce1fa5164491e186d8667dd35c2ea72049773fdc8fe3e0801d4d426085840fb5a7eb5e1b26b0c48829e7101fccb

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    90KB

    MD5

    f3e72bb7431918524ae0d32edc90628c

    SHA1

    f44225e8949b7a81b69e92e6baa013ad0898ab19

    SHA256

    209e954879d035809fdb1e7503504b027e22c179a512c78297f1761ec3951035

    SHA512

    528f25e3c7367334bf93f3db91b3e4f179f34d77832250d1c3263b52a95b666311c4c0cddd85ac969f3a9c56ba9cca906ca4c689c753aa5e93062d7ce45860e6

  • memory/2420-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2420-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB